Method, device, and computer-readable recording medium for visualizing route and behavior of user by linking security threat and security kernel of server-terminal connection network

Abstract

In order to provide a technology, when an access having the possibility of a threatening factor according to an access failure is detected, for collecting information about the access to intuitively display the route of the threatening behavior on an interface that outputs the server-terminal connection network, and directly replaying the threatening behavior to intuitively identify the information on the access and easily identify a cause of the threat, a method for visualizing a route and a behavior of a user by linking a security threat and a security kernel of a server-terminal connection network according to one embodiment of the present invention includes: an access detection step of setting a plurality of terminals, servers accessible from the terminals, and communication processing devices between the terminals and the servers as nodes, and detecting an attempt to access one server from one terminal in a server-terminal connection network including a route on the network connecting the set nodes as links; a log collection step, based on the access detected in the access detection step, of collecting log information generated when the one terminal attempts to access; and a visualization step, when a visualization request input for the log information collected in the log collection step is received from an administrator terminal, of visualizing the nodes, the links and the log information on a visualization interface executed in the administrator terminal, wherein the visualization step, with respect to the log information on access failure, includes using the log information to display a node including a terminal attempting the access and a server to be accessed and links between nodes, and a visual effect indicating failure of log information, on the visualization screen of the server-terminal connection network on the visualization interface.

The invention claimed is: 
     
       1. A method for visualizing a route and a behavior of a user by linking a security threat and a security kernel of a server-terminal connection network and implemented by a computing device including at least one processor and at least one memory for storing instructions executable by the processor, the method comprising:
 an access detection step of setting a plurality of terminals, servers accessible from the terminals, and communication processing devices between the terminals and the servers as nodes, and detecting an attempt to access one server from one terminal in a server-terminal connection network including a route on the network connecting the set nodes as links; 
 a log collection step, based on the access detected in the access detection step, of collecting log information generated when the one terminal attempts to access; and 
 a visualization step, when a visualization request input for the log information collected in the log collection step is received from an administrator terminal, of visualizing the nodes, the links and the log information on a visualization interface executed in the administrator terminal, wherein 
 the visualization step, with respect to the log information on access failure, includes using the log information to display a node including a terminal attempting the access and a server to be accessed and links between nodes, and a visual effect indicating failure of log information, on the visualization screen of the server-terminal connection network on the visualization interface, wherein the visualization step further comprises: 
 displaying an organizational arrangement in which multiple locations are arranged in operational dependencies and allowing a security operator to select a location within the arrangement to check for a login access failure for the selected location; 
 displaying a network topology with a group of the nodes for the selected location and allowing zooming and rotating one or more said nodes and connections between the nodes; and 
 displaying analysis data in a separate user interactive window on a portion of the visualization interface for one or more selected nodes in the network topology, wherein the analysis data includes a total number of logging access failure events and a list of the logging access failure events for corresponding one or more selected nodes. 
 
     
     
       2. The method of  claim 1 , wherein the log collection step includes:
 a first collection step, when access is failed from the one terminal, of collecting access failure time, terminal identification information, a user account attempting the access through the terminal, and an IP of the access behavior; 
 a second collection step of collecting type information on the terminal with failed access and an IP of the terminal from an external database; and 
 a log information generation step of combining the pieces of information collected in the first collection step and the second collection step and processing the combined information into log information. 
 
     
     
       3. The method of  claim 2 , wherein the visualization step includes:
 a threat node identification step, with respect to the log information with failed access, of identifying a node causing the access failure as a cause node by using an IP of the access behavior; 
 a visualization target identification step of identifying a first node corresponding to the terminal attempting to access, a second node corresponding to the server to be accessed, a cause node, and a threat link serving as a link between the first node, the second node, and the cause node; and 
 an effect application step of applying visual effects different from those of the other nodes to the first node, the second node, and the cause node and applying visual effects different from the other links to the threat link, to control an output to be outputted differently from nodes and links included in the server-terminal connection network outputted on the visualization interface. 
 
     
     
       4. The method of  claim 3 , wherein the effect application step includes applying the links containing the cause node and the visual effects on the cause node so as to be differently from other nodes and links identified by the visualization target identification step. 
     
     
       5. The method of  claim 1 , wherein the visualization step includes controlling some nodes and links for the server-terminal connection network to be displayed on the visualization interface through the function of Zoom-in/Zoom-out or the selection of network group subject to the input by the administrator terminal. 
     
     
       6. The method of  claim 1 , further comprising:
 a behavior replay step, when the selected input for the node of interest of the administrator terminal is received after performing the visualization step, of outputting log information performed on the node of interest to one section of the visualization interface. 
 
     
     
       7. The method of  claim 6 , wherein the behavior replay step includes:
 a behavior information tracking step of outputting the log information with access failure among the log information performed on the node of interest, and extracting behavior information, which includes input data inputted for access at the node by using the information included in the log information and access attempt code information generated according to the input data, from the node; and 
 a behavior output step of outputting the behavior information and the log information corresponding to the behavior information to one section of the visualization interface. 
 
     
     
       8. The method of  claim 7 , wherein the behavior output step includes:
 a code analysis step in which the input data and the access attempt code information included in the behavior information are split for each unit function included in the access process and divided into unit codes; 
 a timeline analysis step of calculating a generation timing for each unit code by using the data log of the behavior information; and 
 an output control step of sequentially outputting the unit codes from an output timing of the behavior information based on the generation timing of each unit code. 
 
     
     
       9. A device for visualizing a route and a behavior of a user by linking a security threat and a security kernel of a server-terminal connection network, and implemented by a computing device including at least one processor and at least one memory for storing instructions executable by the processor, the device comprising:
 an access detection unit for setting a plurality of terminals, servers accessible from the terminals, and communication processing devices between the terminals and the servers as nodes, and detecting an attempt to access one server from one terminal in a server-terminal connection network including a route on the network connecting the set nodes as links; 
 a log collection unit, based on the access detected by the access detection unit, for collecting log information generated when the one terminal attempts to access; and 
 a visualization unit for visualizing the nodes, the links and the log information on a visualization interface executed in the administrator terminal, when a visualization request input for the log information collected by the log collection unit is received from an administrator terminal, wherein, the visualization unit, with respect to the log information on access failure, uses the log information to display a node including a terminal attempting the access and a server to be accessed and links between nodes, and a visual effect indicating failure of log information, on the visualization screen of the server-terminal connection network on the visualization interface, wherein the visualization unit is configured to display: 
 an organizational arrangement in which multiple locations are arranged in operational dependencies and allowing a security operator to select a location within the arrangement to check for a login access failure for the selected location; 
 a network topology with a group of the nodes for the selected location allowing zooming and rotating one or more said nodes and connections between the nodes; and analysis data in a separate user interactive window on a portion of the visualization interface for one or more selected nodes in the network topology, wherein the analysis data includes a total number of logging access failure events and a list of the logging access failure events for corresponding one or more selected nodes. 
 
     
     
       10. A non-transitory computer-readable recording medium storing instructions for allowing a computing device to perform:
 an access detection step of setting a plurality of terminals, servers accessible from the terminals, and communication processing devices between the terminals and the servers as nodes, and detecting an attempt to access one server from one terminal in a server-terminal connection network including a route on the network connecting the set nodes as links; 
 a log collection step, based on the access detected in the access detection step, of collecting log information generated when the one terminal attempts to access; and 
 a visualization step of visualizing the nodes, the links and the log information on a visualization interface executed in the administrator terminal, when a visualization request input for the log information collected in the log collection step is received from an administrator terminal, wherein 
 the visualization step with respect to the log information on access failure includes using the log information to display a node including a terminal attempting the access and a server to be accessed and links between nodes, and a visual effect indicating failure of log information, on the visualization screen of the server-terminal connection network on the visualization interface, wherein the visualization step further comprises: 
 displaying an organizational arrangement in which multiple locations are arranged in operational dependencies and allowing a security operator to select a location in the arrangement to check for a login access failure for the selected location: 
 displaying a network topology with a group of the nodes for the selected location and allowing zooming and rotating one or more said nodes and connections between the nodes; and 
 displaying analysis data in a separate user interactive window on a portion of the visualization interface for one or more selected nodes in the network topology, wherein the analysis data includes a total number of logging access failure events and a list of the logging access failure events for corresponding one or more selected nodes.